feat: implement TASK-WP1-04 admin security

2026-07-28 18:32:50 +08:00
parent 66fe3b763a
commit 03f1509de7
29 changed files with 2344 additions and 40 deletions
@@ -0,0 +1,129 @@
+import { createHmac, randomUUID } from "node:crypto";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { RegistrationError, RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+
+const roots: string[] = [];
+const services: RegistrationService[] = [];
+const now = Date.parse("2026-07-28T10:00:00.000Z");
+const adminPepper = Buffer.alloc(32, 0x91);
+
+function allowlistHash(email: string) {
+  return createHmac("sha256", adminPepper).update(email.trim().toLowerCase(), "utf8").digest("hex").toUpperCase();
+}
+
+function createHarness() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp1-04-admin-"));
+  roots.push(root);
+  const resend = new MockResendAdapter();
+  const service = new RegistrationService({
+    adminAllowlistPepper: adminPepper,
+    challengePepper: Buffer.alloc(32, 0x92),
+    clock: () => now,
+    codeGenerator: () => "418205",
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0x93),
+    resend,
+    sessionPepper: Buffer.alloc(32, 0x94),
+  });
+  services.push(service);
+  return { resend, service };
+}
+
+function writeEvidence(file: string, value: unknown) {
+  const directory = process.env.DADA_EVIDENCE_DIR_ADMIN;
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, file), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+afterEach(() => {
+  for (const service of services.splice(0)) service.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP1-ADM-001-admin-auth-boundary", () => {
+  it("keeps admin authentication allowlisted, multi-admin, isolated, and recoverable only by secure config", async () => {
+    const { resend, service } = createHarness();
+    const adminEmails = ["admin-one@example.invalid", "admin-two@example.invalid"];
+    const hashes = adminEmails.map(allowlistHash);
+    service.applySecureConfig({
+      adminAllowlistHashes: hashes,
+      adminRecoveryHashes: [],
+      secureConfigRevision: 1,
+    });
+
+    await expect(service.sendAdminLoginCode({ clientKey: "blocked-client", email: "blocked@example.invalid" }))
+      .rejects.toMatchObject({ reason: "admin_not_allowed" });
+    expect(resend.calls).toHaveLength(0);
+
+    const admins = [];
+    for (const [index, email] of adminEmails.entries()) {
+      const sent = await service.sendAdminLoginCode({ clientKey: `admin-client-${index}`, email });
+      const completed = service.completeAdminLogin({
+        clientKey: `admin-client-${index}`,
+        code: resend.readLatestCode(email),
+        idempotencyKey: `wp1-04-admin-login-${index}`.padEnd(40, "0"),
+        registrationId: sent.registrationId,
+      });
+      expect(completed).toMatchObject({ audience: "admin", status: "authenticated", admin: { role: "super_admin" } });
+      admins.push(completed);
+    }
+
+    const ordinaryUserId = randomUUID();
+    service.database.prepare(`
+      INSERT INTO users (
+        user_id, normalized_email, role, status, counts_toward_stage_limit,
+        registration_id, created_at
+      ) VALUES (?, 'ordinary@example.invalid', 'user', 'active', 1, ?, ?)
+    `).run(ordinaryUserId, randomUUID(), now);
+    const ordinarySession = service.issueAuthenticatedSession(ordinaryUserId, "user");
+    expect(service.readAdminSession(ordinarySession.sessionToken)).toBeUndefined();
+    expect(service.readUserSession(admins[0].sessionToken)).toBeUndefined();
+
+    for (const admin of admins) service.revokeAdminSessions(admin.admin.userId, "disabled");
+    await expect(service.sendAdminLoginCode({ clientKey: "disabled-client", email: adminEmails[0] }))
+      .rejects.toMatchObject({ reason: "account_suspended" });
+    service.applySecureConfig({
+      adminAllowlistHashes: hashes,
+      adminRecoveryHashes: hashes,
+      secureConfigRevision: 2,
+    });
+    await expect(service.sendAdminLoginCode({ clientKey: "recovered-client", email: adminEmails[0] }))
+      .resolves.toMatchObject({ status: "verification_sent" });
+
+    const counts = {
+      adminAccess: service.database.prepare("SELECT COUNT(*) AS count FROM admin_access WHERE allowed = 1").get().count,
+      adminCredits: service.database.prepare(`
+        SELECT COUNT(*) AS count FROM credit_accounts c JOIN users u ON u.user_id = c.user_id WHERE u.role = 'super_admin'
+      `).get().count,
+      admins: service.database.prepare("SELECT COUNT(*) AS count FROM users WHERE role = 'super_admin'").get().count,
+      ordinaryUsers: service.database.prepare("SELECT COUNT(*) AS count FROM users WHERE role = 'user'").get().count,
+    };
+    expect(counts).toEqual({ adminAccess: 2, adminCredits: 0, admins: 2, ordinaryUsers: 1 });
+    const audits = service.database.prepare("SELECT actor_type, actor_ref, result FROM admin_operation_logs ORDER BY occurred_at").all();
+    expect(audits.length).toBeGreaterThanOrEqual(4);
+    expect(audits.every((entry: any) => ["system", "super_admin"].includes(entry.actor_type))).toBe(true);
+    expect(JSON.stringify(audits)).not.toContain("@example.invalid");
+
+    writeEvidence("response.json", {
+      admin_count: counts.admins,
+      audiences_isolated: true,
+      non_allowlisted_status: "rejected_before_send",
+      recovery_source: "secure_config_revision_2",
+      status: "passed",
+    });
+    writeEvidence("db-diff.json", { after: counts, admin_sessions_revoked_before_recovery: true, status: "passed" });
+    writeEvidence("external-calls.json", {
+      calls: resend.calls.map((call) => ({ purpose: call.purpose, recipient_kind: "synthetic_admin" })),
+      non_allowlisted_calls: 0,
+      status: "passed",
+    });
+  });
+});
@@ -0,0 +1,161 @@
+import { createHmac, randomUUID } from "node:crypto";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { readSecureConfigCandidate } from "../../apps/api/src/secure-config.js";
+
+const roots: string[] = [];
+const services: RegistrationService[] = [];
+const now = Date.parse("2026-07-28T11:00:00.000Z");
+const adminPepper = Buffer.alloc(32, 0xa1);
+
+function hash(email: string) {
+  return createHmac("sha256", adminPepper).update(email.trim().toLowerCase(), "utf8").digest("hex").toUpperCase();
+}
+
+function createService(withPepper = true) {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp1-04-config-"));
+  roots.push(root);
+  const service = new RegistrationService({
+    ...(withPepper ? { adminAllowlistPepper: adminPepper } : {}),
+    challengePepper: Buffer.alloc(32, 0xa2),
+    clock: () => now,
+    codeGenerator: () => "418205",
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0xa3),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0xa4),
+  });
+  services.push(service);
+  return service;
+}
+
+function writeEvidence(file: string, value: unknown) {
+  const directory = process.env.DADA_EVIDENCE_DIR_CONFIG;
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, file), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+afterEach(() => {
+  for (const service of services.splice(0)) service.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP1-CFG-001-secure-revision", () => {
+  it("applies one complete revision atomically and rolls invalid candidates back without sensitive persistence", async () => {
+    const service = createService();
+    const firstEmail = "first-admin@example.invalid";
+    const replacementEmail = "replacement-admin@example.invalid";
+    const firstHash = hash(firstEmail);
+    const replacementHash = hash(replacementEmail);
+    const configPath = join(roots[0]!, "instance.json");
+    writeFileSync(configPath, `${JSON.stringify({
+      admin_allowlist_hashes: [firstHash],
+      admin_recovery_hashes: [],
+      schema_version: 1,
+      secure_config_revision: 1,
+    })}\n`);
+    expect(readSecureConfigCandidate(configPath)).toEqual({
+      adminAllowlistHashes: [firstHash],
+      adminRecoveryHashes: [],
+      secureConfigRevision: 1,
+    });
+
+    expect(service.applySecureConfig({
+      adminAllowlistHashes: [firstHash],
+      adminRecoveryHashes: [],
+      secureConfigRevision: 1,
+    })).toMatchObject({ appliedRevision: 1, status: "applied" });
+    const resend = service.options.resend as MockResendAdapter;
+    const sent = await service.sendAdminLoginCode({ clientKey: "first-admin-client", email: firstEmail });
+    const loggedIn = service.completeAdminLogin({
+      clientKey: "first-admin-client",
+      code: resend.readLatestCode(firstEmail),
+      idempotencyKey: "wp1-04-config-first-login-00000000001",
+      registrationId: sent.registrationId,
+    });
+
+    expect(service.applySecureConfig({
+      adminAllowlistHashes: [replacementHash],
+      adminRecoveryHashes: [],
+      secureConfigRevision: 2,
+    })).toMatchObject({ appliedRevision: 2, status: "applied" });
+    expect(service.readAdminSession(loggedIn.sessionToken)).toBeUndefined();
+
+    const ordinaryUserId = randomUUID();
+    service.database.prepare(`
+      INSERT INTO users (
+        user_id, normalized_email, role, status, counts_toward_stage_limit,
+        registration_id, created_at
+      ) VALUES (?, 'ordinary-conflict@example.invalid', 'user', 'active', 1, ?, ?)
+    `).run(ordinaryUserId, randomUUID(), now);
+    const conflictHash = hash("ordinary-conflict@example.invalid");
+    expect(() => service.applySecureConfig({
+      adminAllowlistHashes: [replacementHash, conflictHash],
+      adminRecoveryHashes: [],
+      secureConfigRevision: 3,
+    })).toThrow(/identity_conflict/);
+    expect(() => service.applySecureConfig({
+      adminAllowlistHashes: ["not-a-valid-hmac"],
+      adminRecoveryHashes: [],
+      secureConfigRevision: 3,
+    })).toThrow(/hmac_invalid/);
+
+    const withoutPepper = createService(false);
+    expect(() => withoutPepper.applySecureConfig({
+      adminAllowlistHashes: [replacementHash],
+      adminRecoveryHashes: [],
+      secureConfigRevision: 1,
+    })).toThrow(/admin_pepper_not_configured/);
+
+    const state = service.database.prepare("SELECT * FROM secure_config_apply_state WHERE singleton = 1").get() as any;
+    expect(state).toMatchObject({ allowlist_count: 1, applied_revision: 2 });
+    expect(Object.keys(state)).not.toContain("admin_allowlist_hashes");
+    const audits = service.database.prepare(`
+      SELECT actor_type, actor_ref, operation_type, result, before_summary, after_summary
+      FROM admin_operation_logs ORDER BY occurred_at
+    `).all();
+    expect(audits).toEqual(expect.arrayContaining([
+      expect.objectContaining({ actor_ref: "backend_secure_config", actor_type: "system", result: "succeeded" }),
+      expect.objectContaining({ actor_ref: "backend_secure_config", actor_type: "system", result: "failed" }),
+    ]));
+    const retention = service.database.prepare(`
+      SELECT occurred_at, expires_at FROM admin_operation_logs ORDER BY occurred_at LIMIT 1
+    `).get() as { expires_at: number; occurred_at: number };
+    expect(retention.expires_at - retention.occurred_at).toBe(180 * 24 * 60 * 60 * 1_000);
+    expect(() => service.database.prepare(`
+      UPDATE admin_operation_logs SET result = 'failed' WHERE log_id = (SELECT log_id FROM admin_operation_logs LIMIT 1)
+    `).run()).toThrow(/admin_operation_logs_immutable/);
+    expect(() => service.database.prepare(`
+      DELETE FROM admin_operation_logs WHERE log_id = (SELECT log_id FROM admin_operation_logs LIMIT 1)
+    `).run()).toThrow(/admin_operation_logs_immutable/);
+    const redactionProbe = JSON.stringify({ audits, state });
+    for (const forbidden of [firstEmail, replacementEmail, firstHash, replacementHash, adminPepper.toString("hex")]) {
+      expect(redactionProbe).not.toContain(forbidden);
+    }
+
+    writeEvidence("config-result.json", {
+      applied_revision: state.applied_revision,
+      failed_candidates: ["identity_conflict", "hmac_invalid", "admin_pepper_not_configured"],
+      status: "passed",
+    });
+    writeEvidence("db-diff.json", {
+      after: { allowlist_count: state.allowlist_count, applied_revision: state.applied_revision },
+      removed_admin_sessions_revoked: true,
+      rejected_revision_advanced: false,
+      status: "passed",
+    });
+    writeEvidence("redaction.json", {
+      forbidden_values_absent: true,
+      stored_secure_state_fields: Object.keys(state).sort(),
+      status: "passed",
+    });
+  });
+});